PT-2010-1580 · Paypal+1 · Paypal Website Payments Standard+2

Published 2010-04-20 · Updated 2017-08-17 · CVE-2009-4771

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Ubercart module versions 5.x before 5.x-1.9 Ubercart module versions 6.x before 6.x-2.1

Description The issue is related to the PayPal Website Payments Standard functionality in the Ubercart module for Drupal, which does not properly validate orders. This allows remote attackers to trigger unspecified "duplicate actions" via unknown vectors.

Recommendations For Ubercart module version 5.x, update to version 5.x-1.9 or later. For Ubercart module version 6.x, update to version 6.x-2.1 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2009-4771

Affected Products

Drupal

Paypal Website Payments Standard

Ubercart

References · 7

• http://drupal.org/node/636576 · Vendor Advisory
• http://secunia.com/advisories/37440 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-4771 · Security Note
• http://securityfocus.com/bid/37058 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4771 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54346 · Note
• http://osvdb.org/60290 · Note